Splunk query to display % failures

[VS0909]

Need help with a Splunk query  to display % failures 

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

A2= Total number of events returned by the below query:

index="xyz"  "searchTermForA2"

Please help with the query.

Thanks!

[VS0909]

(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2

 is not giving the correct count for A1 and A2 , when compared to executing index="abc" "searchTermForA1" and   index="xyz" "searchTermForA2" separately.

Need help with a Splunk query  to display % failures 

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

A2= Total number of events returned by the below query:

index="xyz"  "searchTermForA2"

Please help with the query.

Thanks!

[kamlesh_vaghela]

(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2

This should work. Can you please try this?

index="abc" "searchTermForA1" | stats count as A1 | appendcols [ search index="xyz" "searchTermForA2"| stats count as A2]
| eval "% failures" = A1/A2 *100

[kamlesh_vaghela]

@VS0909 

Try something like this.

(index="abc"  "searchTermForA1") OR (index="xyz"  "searchTermForA2")
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2
| eval "% failures" = A1/A2 *100

[VS0909]

@kamlesh_vaghela  Thanks for the reply!

But for "A1= count(eval(index="abc"))" 

My requirement is A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

A2= Total number of events returned by the below query:

index="xyz"  "searchTermForA2"

A1  and A2 should include count filter by index and search term.

[kamlesh_vaghela]

@VS0909 

Events are already filtered with

(index="abc"  "searchTermForA1") OR (index="xyz"  "searchTermForA2")

So only index filter is enough to identify events,

| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2

So just try and let me know if any issue.

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.